Google's managed agents in the Gemini API now intercept their own tool calls with developer-supplied scripts, and the default agent has switched to Gemini 3.6 Flash with zero code changes S¹. The hooks mean a developer can block an agent from deleting a file or calling an external API before the agent ever touches it. What that opens up is the gap between an agent that runs inside a sandbox and one that runs under your policy. The update landed July 28 on a free tier S¹.

My read: This is the first agent platform I've seen that builds guardrails directly into the execution runtime rather than bolting them onto the prompt. The pre-tool hook returning a structured "deny" decision that feeds back into the model's context is a clean design. I don't buy that the free tier is generous enough for production use yet, because Google gave zero details on limits. But for prototyping agentic workflows with real safety constraints, this is the right architecture.

One API call, a whole cloud computer

A managed agent in the Gemini Interactions API is not a chatbot with a function-calling wrapper. One API request brings together reasoning, code execution, package installation, file management, and web retrieval within a sandboxed cloud environment S¹. The agent can write and execute code, pull in Python packages, manage files on disk, and retrieve live web pages, all without the developer spinning up any infrastructure.

This builds on a July 7 release that added background tasks for asynchronous execution and remote MCP server integration P⁵. Google's managed agents can already talk to remote MCP servers. The new additions, three weeks later, are about control and model choice.

The hook that stops an agent mid-step

Environment hooks are the headline feature. Developers place a .agents/hooks.json file in the agent's sandbox, and the runtime fires custom handler scripts at two lifecycle points: pre_tool_execution and post_tool_execution S¹.

The pre-tool hook is where it gets interesting. When the handler script returns a JSON object containing "decision": "deny" along with a reason, the tool call never runs, instead, the rejection reason gets injected back into the model's context S¹. The agent learns it was blocked and why. That is a fundamentally different mechanism from prompt-level instructions like "don't delete files," which models routinely ignore.

The matcher field in the hooks config takes regular expressions, letting developers target particular tools, combine multiple tool names with the pipe operator, or match all tools using a wildcard * S¹. Hooks can also use http type handlers that send POST requests to an external endpoint, so the policy logic can sit on a separate service instead of inside the sandbox S¹.

Three models, one default

The antigravity-preview-05-2026 agent now defaults to Gemini 3.6 Flash without requiring any code changes S¹. Google published the Gemini 3.6 Flash model card on July 21, describing it as a balanced model for reasoning, coding, and tool use [P3, P4]. Developers can override the default by passing agent_config.model when creating an interaction or managed agent S¹.

Three models are supported S¹:

  • Gemini 3.6 Flash (gemini-3.6-flash): the default, tuned for reasoning, coding, and tool use.
  • Gemini 3.5 Flash (gemini-3.5-flash): the prior generation, suited for general agentic workflows.
  • Gemini 3.5 Flash-Lite (gemini-3.5-flash-lite): the lowest-latency, lowest-cost option in the Gemini 3.5 family.

The model swap is free in two senses. It costs nothing to switch, and the managed agents now have free tier access S¹. Google has not published the free tier limits.

What to do about it

Consider a logistics company that builds a managed agent to scan incoming shipment PDFs, extract customs codes, then update a database. Without hooks, the agent could theoretically execute a tool that writes to the wrong table or calls an external API with sensitive data. With a pre_tool_execution hook matched to the database-write tool, a developer can inspect the query, check it against an allowlist, then return {"decision": "deny", "reason": "table 'customers' is read-only"} if the agent tries to write somewhere it shouldn't. The agent gets the rejection in context and adjusts. No prompt engineering required.

The practical starting point this week: install the Interactions API skill with npx skills add google-gemini/gemini-skills --skill gemini-interactions-api S¹, spin up a managed agent on the free tier, and write a single pre_tool_execution hook that logs every tool call to a file. That gives you a full audit trail of what the agent actually does inside its sandbox before you add any policy logic.

What we don't know yet

The free tier is mentioned but its limits and eligibility terms are unspecified S¹. The agent name, antigravity-preview-05-2026, signals this is still a preview product. The default model change to 3.6 Flash is confirmed only for that specific agent, not for managed agents generally S¹. The source text is truncated where it discusses HTTP hook failure-handling semantics, so we don't know what happens when an external HTTP hook endpoint is unreachable or returns an error S¹.

Google's blog post relies on TypeScript and JavaScript examples from the @google/genai SDK and points Python and cURL users to separate Antigravity agent docs S¹. Whether that documentation covers the full hooks API or just basic setup is unknown.

The next signal: Google's Gemini API pricing page update, which should clarify free tier limits for managed agents. We'll check it against the claims in this announcement.

If you found this useful, subscribe for the next one. We read the docs so you know what actually shipped.

Sources: S1 — Gemini API Managed Agents: 3.6 Flash, hooks, and more · S2 — Gemini API Managed Agents: 3.6 Flash, hooks, and more - blog.google · P3 — 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber · P4 — Gemini 3.6 Flash - Model Card — Google DeepMind · P5 — What’s new in Managed Agents in Gemini API · P6 — google-gemini/gemini-managed-agents-templates

More from Not A Tech Guy

Generated from an audited evidence pack with primary-source research. Social-media items are discussion signals, not verified facts. Nothing here is financial, legal or medical advice.

Gemini managed agent model options